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Introduction to Internet Matters 


Internet Matters is a not-for-profit organisation dedicated to helping families keep their children safe online. We 
are pro-technology, as we believe children from connected homes have better outcomes, and we are focused on 
providing evidenced based, useful and practical advice to families at their point of need. Our resources come in 
many ways — by age of child, by issue, by app, device or platform. We are backed by some of the largest companies 
in the world and through them we are able to reach almost all UK parents. We know that nearly 9 in 10 parents will 
recommend us to friends and family, and as a result of seeing our content parents are significantly more likely to 
take some form of action to minimise the risks their children face online. We sit on the Executive Board of UKCCIS 
and lead a working group on protecting vulnerable users online. 


Summary of our response to the Draft Code 


The age appropriate design code is an ambitious and welcome move which recognises the importance society 
places on online safety for children and seeks to better protect them. Grounded in the Kidron amendment to the 
Data Protection Bill, ICO has taken a wide interpretation of the wording in the Act, and there is much to support in 
it. There can be no doubt that the code will address many of the online risks that children face today. We agree 
that children should have the same protections online as they do offline, and the code does much to deliver against 
this challenge. The principle of centring children’s wellbeing and best interests at the heart of the services they 
actually use is to be applauded and is one we wholeheartedly support. We share the intent and ambition of the 
UNCRC on the best interests of the child. As an online safety organisation, we are committed to campaigning for 
greater protection for children online and lend our support to the code. 


We also share the view that companies who provide services that children use online could and must do more to 
keep children safe. Of course, transparency is vital, as is an end to data misuse. Likewise, we agree that privacy 
settings should be high by default for younger children, with older children enjoying a more age appropriate 
environment as they grow up. The goal should be to create a culture where companies could race to the top, in 
their efforts and investment to keep children safe online. 


However, we find that further clarification and consideration is required in order to ensure the code does not have 
unintended consequences. From our reading of the code as currently written, we believe there is a risk that the 
code will not necessarily achieve the outcomes we all want - both a safer internet for children, but also one that 
continues to provide them with a rich, engaging, and innovative environment in which they can grow, learn and 
thrive in our fast moving, digital world 


We believe it is important to focus on the harm we are trying to prevent, rather than the technology through which 
the harm is manifest. This approach drives to the heart of the problems, rather than the technology that is used, or 
the data being collected. It may also very well be in the best interests of the child. 


So, whilst the intention and some of the principles of the code are good and ground-breaking, we have some 
concerns with the scope, legal basis, and approach of the draft code, and would welcome more clarity around the 
following points. In our judgment, investing the time to get the fundamentals right at the start will increase the 
likelihood of the Code landing well and achieving its objectives, making the UK the safest place for a child to be 
online. 


1. Scope of the Code - The reliance on ‘likely to be used by a child’ wording in the Act is imprecise and may 
lead to unintended consequences. 


2. Friction with GDPR - Elements of this code appear to be in conflict with the GDPR requirements for data 
minimisation. This could create confusion and complication and risks legal wrangling, which could 
undermine the implementation of the code. 
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Content regulations - Breadth of the cumulative and interconnected provisions means the code flows 
between design and content regulation, which was unexpected, and doesn’t take account of the code of 
conduct proposed in the Online Harms White Paper. 


Proportionality - The current approach is prescriptive rather than proportionate, which seems to put it at 
odds with both your own research findings and our own. Whilst parents do want companies throughout 
the internet eco-system to do more to help them keep their children safe, they do appreciate the benefits 
of connectivity. We welcome a rebalancing of the asymmetrical relationship between tech, parents and 
children. A focus on the harms may be achieve this faster and more effectively. 


Aligning ambitions - The tone and approach of this code is different from the Online Harms White Paper, a 
contrast made even more stark because of the proximity of publication. Additional clarity would be 
welcomed on the relationship between the Online Harms White Paper and the Code. Whilst we appreciate 
they are owned in different parts of the machinery of government, they overlap in many places so greater 
clarity would be helpful. 


Further clarification is required on the following: 


1. 


Scope — “Likely to be used by a child” - We are concerned about the unintended consequences of this 
scoping clause. Whilst we recognise its provenance from the Act, the interpretation used for the code could 
be problematic. It could in effect cover significant parts of the internet. Whilst we understand and welcome 
the ambition to get beyond the services targeted to children - reflecting their actual behaviour - the current 
wording would benefit from greater clarification. For example, guidance around these types of questions 
would be helpful: 

e What does the ICO deem to be an acceptable way of determining likelihood that children use a 
given service? Clearly the ambition to minimise data collection from children is an important 
principle in the code, yet there is a requirement to understand the age range of likely child users in 
order to meet the intent of the code. 

e Where does the proportionality principle fit when assessing ‘small proportion’ of users? Will the 
Commissioner provide a percentage of users, or should this assessment be based on actual 
numbers of people? 

e What evidence would the Commissioner accept on user age? Would a sample of users provide an 
acceptable level of reassurance (and what sample size would be deemed robust)? This approach 
would seem more consistent with the data minimisation requirements of GDPR than a wholesale 
requirement to prove the age of all users. Such a burden may be deemed excessive for all websites 
to comply with, introducing a need to share personal data prior to visiting a site. 


This is of direct relevance to Internet Matters as the effect of the code could mean that websites like our 
own (www. internetmatters.org) which exist to keep children safe online will, as it currently stands, need to 
be behind an age gate as we cannot prove that children do not visit the site for advice on how to stay safe 
online. As the default position is to follow the code, this gives us the unenviable choice of either ‘dumbing 
down’ content to be age appropriate for young children or implementing robust age verification. This could 
be an unintended consequence of a well-intentioned idea. 


A proportionate approach that seeks to prioritise the types of services that children acknowledge they use, 
where they present a known risk to children, must be at the heart of this new code. Whilst we 
wholeheartedly agree that children need special protection, a more considered approach that better reflects 
the reality of how children and adults use the internet could make the code more effective. One example of 
this is the forthcoming implementation of age verification on online pornography websites. Addressing a 
specific harm with a targeted response may create an easier and more effective basis for compliance with 
the code, and is likely to achieve wider support and higher degrees of compliance. 
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2. Friction with GDPR — our understanding of the code would suggest practical implementation may bring it into 
conflict with GDPR on at least two counts: 

e Age of a child - Our understanding is that there is some flexibility under the GDPR regulations for 
the local DPA to set the age under which people are considered children. That number varies across 
member states between 13-16 years, and in the UK is 13. However, the code suggests everyone 
under 18 is a child. We are not clear on how this could work, when the legal basis for the Code 
resides in GDPR. We are concerned that this lack of clarity will undermine the intentions of the 
code and get caught up in legal wrangling. 

e Data minimisation - One of the guiding principles of GDPR is data minimisation. The draft code 
seems to undermine that by requiring documentary evidence that websites are not visited by 
children. This will necessitate either full compliance with the code, meaning every website must be 
suitable for children, or some element of information gathering to verify the age of its users. We 
cannot reconcile these two objectives and are unclear which would take precedence. Clarity would 
be welcome here. 


3. Breadth of the cumulative and interconnected provisions means the code flows between design and content 
regulation, which was unexpected, and doesn’t take account of content tools that already exist. We had 
expected the Age Appropriate Design to focus on design, but it’s clear that the ambitions of the code stretch 
significantly further than that into content. We observe that this is an interesting choice, given the Online 
Harms White Paper. It would be helpful to have more clarity on the relationship between the two documents. 
Age verification is already in place on gambling websites, and soon to be on online pornography websites. 
Internet Matters research on age verification’ suggests parents overwhelmingly support age verification as a 
way to ensure children are not exposed to adult content (83%), but also for other classifications of site, 
including drugs, self-harm and suicide. Could the code be more specific as to when age verification is 
required? 


4. Code is not supported by your research findings - the research you have published on this subject - 
conducted by Revealing Reality - does not seem to support such a wholesale change to the internet, where 
the code appears to suggest either age verification for every website or produce content suitable for the 
youngest of children. Your survey, much like our own research, demonstrates that parents and children have 
varying degrees of concern and interest in this area, and will reach different and sometimes conflicting 
conclusions based on the balance of privacy vs convenience. In a well-intentioned attempt to make the 
internet a better place for children, this code has missed the trade-offs that internet users make balancing 
free apps with personalisation and convenience and cost. Threaded throughout the research findings are 
reflections, conclusions and comments that suggest parents and children have both a nuanced and imperfect 
understanding of how data is used by internet companies. 


* Internet Matters Report “We need to talk about Pornography” - to be published in June 2019. 
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We’ve taken a selection of three paragraphs from different pages in the report to highlight this: 


Some saw profiling as having benefits for their children. YouTube recommendations, for example, were seen 
as especially convenient, while others valued their children being shown educational content online. Others - 
especially parents and carers of neuro-atypical children - saw profiling as problematic. They noted that 
neuro-atypical children often struggle to express themselves when using search engines, meaning that they 
frequently access content that they weren’t looking for — from Page 24 


The code suggest that nudge techniques may not be used to ‘extend use’ without consideration for the 
purpose of that extended use, which may not be harmful in any way. 


When adverts are guaranteed, targeted marginally trumps ‘random’. In the context of sites requiring 
advertising revenue to remain free to use, parents and carers preferred that their child received targeted 
rather than “random” advertising - 55% vs. 45%, (Figure 10). It is worth noting that the language of the 
question answers could play a part in the outcome — “random” could be perceived negatively, and earlier in 
the survey we have discussed the idea that targeting could mean providing age appropriate adverts, which 
is largely seen as positive — from Page 43 


The codes suggest that profiling is only acceptable for a ‘compelling reason’ which would seem to suggest 
that children will be excluded from all services that are provided free on the basis of targeted advertising, 
which could well include educational, fun and creative sites. 


Addressing these challenges 
For the code to achieve its objectives we believe would propose a number of things for the ICO to consider: 


1. The principle of proportionality should be adopted, in tandem with the best interests of the child, which 
would bring this code more into line with the approach taken by the Online Harms White Paper and 
provide a more targeting approach which may have a greater impact. We share the view which perhaps 
guided the development of the code - that tech companies could and must do more to keep children safe 
online. The way to achieve this, in our judgement, is for the code to be proportional becoming a critical 
document that changes the very way companies engage with children. 


2. The best interests of the child should, in our judgement, take due regard of harms, rather than simply 
considering the technology. This would provide some future proofing and a more realistic understanding of 
what the internet is and how children use it. One way to think about this is to focus on the harm, rather 
than the technology. We would all agree that using Al to nudge children towards self-harm content is not a 
good thing. However, using the very same technology to nudge children towards educational opportunities 
is good them, for that child and for society. Therefore, a more harms-based focus could serve children 
better. 


3. It is important the code does not unintentionally result in the withdrawal of positive online experiences for 
children. The technical implications of the code have to be deliverable by the time the code comes into 
force. Some of these standards may be so technically complex that compliance within such a short 
timeframe will be very challenging, and as a result services may have to be withdrawn. Whilst it’s tempting 
to think that big tech companies can always find the solutions to issues if they spend enough, we would 
welcome more time to understand how best to achieve the objectives of the code. 


Achieving this noble intent is complex, challenging and untried. Common sense would suggest that there is more 
tech companies can do, and that technology solutions can deliver so much. However, technical solutions are not 
the only way to address to online harms. Many harms are behavioural, which the code does not always consider 
(although the White Paper does). Internet Matters has long argued that a critical factor in putting children’s 
interests first is to educate parents on online safety and digital wellbeing, through a public service broadcasting 
campaign. Whilst some things are complex the message here is not - it’s simply to urge parents to get involved with 
their children’s online lives and refer them to a website with expert information tailored for them. We believe that 
will go a long way towards helping children flourish online — which has to be in their best interests. 
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Conclusion 


We all want the Age Appropriate Design Code to work. We want to create a safer and better online experience for 
children and adults, where the benefits of connectivity can be enjoyed, and the risks and harms reduced. The aims 
and objectives of the code to design a more age appropriate internet is spot on, and which we support 
unreservedly. Greater clarity is needed however to move this draft code from what is it, into a workable code 
which will have the significant impact we all want it to and enable children to flourish. This is such an important 
document; we have to take the time to get it right. This code will be a critical document that changes the very way 
companies engage with children. 


Internet Matters — Response to ICO Consultation May 2019 Page of 6 of 6 


